Kai Ole Hartwig

The classic path bakes app code into the image via COPY — every code release becomes an image build, runtime and code are coupled. Instead: code as its own OCI artifact via ORAS in the same registry, deployed through a one-shot oras-init container into a shared volume, services on an empty golden image. Including the sharp edges (entrypoint override, path validation, symlinks, stale content) and the honest limit: containerd doesn't (yet) mount OCI artifacts natively.

S3 as a fileadmin volume only gets cheap and fast when not every request reaches S3. Three cache layers (browser with immutable, Souin in the reverse proxy, GeeseFS RAM) plus the decision to serve fileadmin as static, content-addressed files past the TYPO3 frontend. Including the sharp edges: building the arm64 driver yourself, world-writable modes, Souin PURGE limits, and the 404 trap with immutable.

Instead of shorter poll intervals, the release becomes an event: an opt-in step in the semantic-release job triggers a minimal Renovate run that bumps only your own artifacts via the datasource (gitlab-tags/-releases/-packages). Three cadence tiers — security instantly, first-party in minutes, external in a 4-hour window with a soak period. Including the sharp edges: OSV CLI flag beats config, pruneStaleBranches, trigger variable encoding, burst debouncing.

What 14.3.1 and 13.4.29 change, which bugs matter for operators, and in what order you should roll out.

Three vulnerabilities in apko, disclosed on 9 May 2026, push the boundaries of trust in the Wolfi/Chainguard build pipeline: path traversal, a missing hash comparison against the signed index, and a type-assert panic. Patch directly to 1.2.7, plus a dedicated SBOM verification stage as a structural response.

Why classical SEO routines only half-cover layer 2 and miss layers 1, 3 and 4 entirely — plus an operator decision block for the right build order.